System Hardening Checklist

™

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Free Plus Premium Contact

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

About this System Hardening Checklist Page Contributor maintained wiki page.
Support Status	stable
Difficulty	easy
Contributor	torjunkie
Support	Support

Whonix^™ comes with many security features. Whonix^™ is Kicksecure^™ Hardened by default and also provides extensive Documentation including this System Hardening Checklist. The more you know, the safer you can be.

This page is targeted at users who wish to improve the security of their systems for even greater protection.

Introduction

Recommendations specific to Qubes-Whonix^™ or Non-Qubes-Whonix are marked accordingly.

It is possible to significantly harden the Whonix^™ and/or host platform. This reduces the likelihood of a temporary or persistent compromise, while increasing the chances of successful, anonymous activity. Hardening is dependent upon a user's skill set, motivation and available hardware. The checklist below is intended to provide a quick overview of important issues, categorized by difficulty level - easy, moderate, difficult and expert.

Easy

Anonymous Blogging, Posting, Chat, Email and File Sharing

• To remain anonymous, follow all the Whonix^™ recommendations to minimize threats of keyboard/mouse biometrics, stylometric analysis and other covert channels.
  • A browser is an unsafe environment to directly write text, regardless of whether it is a forum post, email, webmail or IMAP-related reply.
    • At a minimum users should not type into browsers with JavaScript enabled, since this opens up this deanonymization vector. Text should be written in an offline text editor and then copied and pasted into the web interface when it is complete.
• Remove metadata from documents, pictures, videos or other files before uploading them to the Internet.
• Think twice before sharing "anonymous" photos due to unique embedded noise signatures that have no known countermeasures.
• Be careful sharing anonymous documents. Digital watermarks with embedded covert data are robust, so run documents through Optical Character Recognition (OCR) before sharing the output.
• Utilize OnionShare to anonymously share or receive files securely over the Tor network, anonymously chat, or host anonymous websites.

Command Line Operations

• Do not run commands unless they are completely understood -- first refer to a suitable Whonix^™ wiki resource if available.
• If root privileges are required, run the command with sudo rather than logging in as root or using sudo su.
  • Consider disabling the root account permanently.
  • To prevent malware sniffing the root password, before performing administrative tasks that require root access, create an admin user account with sudo permissions.
  • Prefer sudoedit for better security when editing files.
• Defeat login spoofing by using the Secure Access Key ("Sak"; SysRq + k) procedure.
• Consider enabling SysRq "Security Keys" functionality as insurance against system malfunctions -- this assists in system recovery efforts and limits the potential harm of a malware compromise.

Disabling and Minimizing Hardware Risks

• Unplug external devices when not needed.
• Consider disabling microphones where possible (muting on the host) or better, physically removing them.
• Since speakers (all audio output devices) can be turned into microphones, if possible, physically remove speakers on the host and remove/disable the beeper.
• Preferably detach webcams or even better, physically cover webcams with a sticker or switch unless they are in use.
  • If using Qubes-Whonix^™, assign the webcam to an untrusted VM (if needed).
• Avoid using wireless devices, since they are insecure.
• Preferably disable or remove Bluetooth hardware modules.
• Disable or remove problematic devices like ExpressCard, PCMCIA, FireWire or Thunderbolt which may allow attackers with physical access to read RAM.
• Do not enable audio input to any VM unless strictly required.
• Apply CPU microcode updates .
• Consider restricting hardware information to the root user in Whonix^™.
• In Qubes-Whonix^™, only use a mouse and keyboard utilizing PS/2 ports (not USB ports) to prevent malicious compromise of dom0 (PS/2 adapters and available controllers are required).

Entropy

• To mitigate against inadequate entropy seeding by the Linux Random Number Generator (RNG), it is recommended to install daemons that inject more randomness into the pool.
  • From Debian 10 ("Buster"), jitterentropy-rngd is available; see footnote.
  • haveged also uses CPU timer jitter to generate entropy and additional entropy sources cannot hurt; see footnote.

Dedicated Computer

For high security, it's best to use a dedicated computer only for the purpose of using Whonix^™ and nothing else. For other use cases, use completely different hardware including a different screen.

This is to lower the impact of fingerprinting VMs in case they get ever compromised.

Related: VM Fingerprinting

Forum discussion: https://forums.whonix.org/t/high-opsec-recommendation/17237

File Handling

Qubes-Whonix^™ only.

• In File Manager, disable previews of files from untrusted sources. Change file preferences in the Template's File Manager so future App Qubes inherit this feature.
• Files received or downloaded from untrusted sources (the internet, via email etc.) should not be opened in a trusted VM. Instead, open them in a Disposable: Right-click → Open In Disposable
• Untrusted PDFs should be opened in a Disposable or converted into a trusted (sanitized) PDF to prevent exploitation of the PDF reader and potential infection of the VM.

File Folder Permissions

• Linux user account nobody has no special meaning.
• Also linux user group nogroup has no special meaning either.
• Therefore the user should avoid running programs under user nobody and/or group nogroup as well as avoid setting file or folder permissions to that user / group.

File Storage Location

• Avoid storing files directly in the root home folder and create appropriate sub-folders instead.
• Move files downloaded by Tor Browser from the ~/Downloads folder to another specially created one.

Mandatory Access Control

• Enable all available apparmor profiles in the Whonix-Workstation^™ and Whonix-Gateway^™ Templates.
• Enable seccomp on Whonix-Gateway^™ (sys-whonix ProxyVM).

Mobile Devices

Warning: Phones, smartphones, smartwatches, tablets and similar mobile devices are vulnerable to advanced malware and can be abused for eavesdropping, espionage, location tracing and more.

• Since the mobile devices security best practices for risk mitigation are often difficult / infeasible to adhere to, it might be easier to physically move all mobiles devices to a distant physical location such as a different room and close the door and/or to power off mobile devices.

Passwords and Logins

• Use strong, unique and random passwords for all online accounts, system logins and encryption / decryption purposes to prevent the feasibility of brute-forcing attacks.
• Use a trusted password manager (KeePassXC) , so hundreds of different passwords can be kept stored in an encrypted password database, protected by one strong master password.
• For high-entropy passwords, consider using Diceware passphrases.
• In Qubes-Whonix^™, store all login credentials and passwords in an offline vault VM (preferably with KeePassXC) and securely cut and paste them into the Tor Browser.
• Read and follow all the principles for stronger passwords.

Screensavers

• At a minimum, lock the screen of the host when it is unattended.
• For better security, shut down the computer entirely -- screensavers are notoriously insecure.

Secure Downloads

• Download Internet files securely using scurl instead of wget from the command line.
• When downloading with Tor Browser, prevent SSLstrip attacks by typing https:// links directly into the URL / address bar.
• Prefer onion services file downloads, which provide greater security and anonymity than https.

Secure Qubes Operation

Qubes-Whonix^™ only.

• Refer to the Qubes-Whonix^™ security recommendations and always follow the latest security news and advice from the Qubes team.

Secure Software Installation

• Default to Debian's official package manager APT for installing software, and avoid third party package managers.
• When possible, use mechanisms which simplify and automate software upgrades and installations, like apt functions.
• Prefer installation of software from signed (Debian) GNU/Linux repositories and avoid manually installing software, particularly if it is unsigned.
• Set the Qubes, Debian and Whonix^™ package updates to Tor onion service repositories.
• For safer installations or updates, first stop all activity/applications and rotate the Tor circuits .
• Always verify key fingerprints and digital signatures of signed software before importing keys or installing software.
  • Avoid using keyservers if possible.
  • It is safer to securely download the key from a source that is logically connected to the owner, if possible, outside the keyserver model.

Updates

• Operating System Updates: It is crucial to regularly check for operating system updates on the host operating system, and both the Whonix-Workstation^™ and Whonix-Gateway^™.
• Stay tuned: It is absolutely crucial to subscribe to and read the latest Whonix^™ news category 'important-news' to stay in touch with ongoing developments. This way users benefit from notifications concerning important security advisories, potential upgrade issues and improved releases which address identified issues, like those affecting the updater or other core elements. Follow Whonix^™ Developments.
• Debian Security Announcements: Since Whonix^™ is based on Debian, users should consider subscribing to the Debian security announcement mailing list to stay informed about the latest security advisories. See also chapter Debian Security Announcements.

Tor Browser Series and Settings

• Prefer the stable Tor Browser release over the alpha series in line with Tor developer recommendations; see footnotes.
• Run the Tor Browser Security Slider in the highest position.
• Disable Javascript by default and only allow it sparingly for trusted sites.
• Do not configure custom NoScript (per-site) settings which persist across successive Tor Browser sessions because this aids fingerprinting.
• Use .onion services where possible to stay within the Tor network, such as defaulting searches to the DuckDuckGo onion service.
• Use multiple Tor Browser instances or multiple Whonix-Workstation^™ to better compartmentalize contextual identities.
• Follow all other Whonix^™ recommendations for safe and anonymous use of Tor Browser.
• Install Tor Browser outside of Whonix^™ so a second, working instance is always available for anonymous activities.

Virtual Machines

All Virtualizers

• Remove the virtual audio controller to VMs from getting access to a microphone (eavesdropping risk) or speaker (profiling threat).

VirtualBox

• Remove a host of VirtualBox features to reduce the attack surface.
• Take regular, clean VM snapshots that are not used for any activities.
• Spoof the initial virtual hardware clock offset.
• Consider disabling clipboard sharing to reduce the risk of identity correlation.
• Shared folders are discouraged because they weaken isolation between the guest and the host.

Warrant Canary

• Learn more about warrant canaries -- see [[Trust#Whonix^™_Warrant_Canary|Whonix^™ Warrant Canary]] (forum discussion) and limitations of warrant canaries.

Moderate

Create a USB Qube

Qubes-Whonix^™ only.

• Prepare and safely utilize a USB qube.
• Configure a disposable sys-usb.

Host Operating System Distribution

Non-Qubes-Whonix^™ only.

• For a truly private operating system, install GNU/Linux on the host.
• The Debian distribution is recommended by Whonix^™ as providing a reasonable balance of security and usability.
  • Consider installing the Kicksecure^™ Debian derivative, since it has considerable security hardening by default.

Host Operating System Hardening

All Platforms

• Use Full Disk Encryption (FDE) on the host.
• Apply a BIOS password for BIOS setup and boot.
• Torrify APT traffic on the host to prevent fingerprinting and leakage of sensitive security information.
• Follow all other Whonix^™ recommendations to further harden the host OS against physical attacks.

Non-Qubes-Whonix Only

• Harden the host Debian Linux OS.

Kernels / Kernel Modules

Note:

• Cutting-edge kernels can destabilize the system or cause boot failures.
• Newer kernels can expose additional vulnerabilities; see footnotes.
• Kernel modules in Qubes and Qubes-Whonix^™ usually require configuration of a Qubes VM Kernel.

• To benefit from additional protections, consider installing newer kernels.
  • On the host Linux platform.
  • In Whonix^™ VMs.
  • Qubes: in dom0 and in Qubes VMs (see Qubes VM Kernel).
• Consider installing the Linux Kernel Runtime Guard (LKRG) kernel module for improved detection and protection against common kernel exploits.
• In Qubes-Whonix^™, consider installing the tirdad kernel module to protect against TCP ISN-based CPU information leaks.
• Advanced users can undertake host kernel hardening to significantly increase security and privacy.

Live-mode

Non-Qubes-Whonix^™ only.

• Consider running Whonix^™ with Live Mode in a VM or even better in Whonix^™ as HOST os, so all writes go to RAM instead of the hard disk.
  • If Debian is run as the host OS, consider also booting into Live Mode.
• Disable swap and program crash dumps as an anti-forensics precaution.
• When using Live Mode in a VM, consider enabling read-only hard drive mode to make it harder for malware to gain persistence.

Memory Allocator

• Consider installing a hardened memory allocator ('Hardened Malloc') to launch regularly used applications.

Networking

All Platforms

• If possible, use a dedicated network connection (LAN, WiFi etc.) that is not shared with other potentially compromised computers.
• If using a shared network via a common cable modem/router or ADSL router, configure a de-militarized zone (perimeter network).
• Test the LAN's router/firewall with either an internet port scanning service or preferably a port scanning application from an external IP address.
• Change the default administration password on the router to a unique, random, and suitably long Diceware passphrase to prevent bruteforcing attacks.
• WiFi users should default to the WPA2-AES or WPA3 standard; the protocols are safer and have stronger encryption.
• Follow all other Whonix^™ recommendations to lock down the router.
• Disable TCP SACK to limit the risk of remote DoS and other attacks.

Qubes-Whonix^™ Only

• Prefer the Debian Template for networking (sys-net and sys-firewall) since it is minimal in nature and does not "ping home", unlike the Fedora Template.
• Consider using customized minimal templates for NetVMs to reduce the attack surface and memory requirements. Four options are currently available:
  • CentOS
  • Debian.
    • Debian can optionally be morphed into a Kicksecure^™ Template for greater security.
  • Fedora
  • Gentoo
• For greater security, higher performance and a lower resource footprint, consider using an experimental MirageOS-based unikernel firewall that can run as a QubesOS ProxyVM.
• Consider utilizing OpenBSD for sys-net to reduce the attack surface. See also other OpenBSD considerations.

Sandboxing

• Consider using Firejail to restrict Tor Browser, Firefox-ESR, VLC and other regularly used applications -- note this comes with an increased fingerprinting risk and any vulnerability in Firejail can allow escalation to root privileges.
• In a future Non-Qubes-Whonix release, consider using sandbox-app-launcher (Sandboxed Application Launcher) to restrict applications within a bubblewrap sandbox and confined by AppArmor.

Spoof MAC Addresses

Tip: MAC spoofing is only necessary if traveling with your laptop or PC. It is not required for home PCs that do not change locations.

• In Qubes-Whonix^™, follow these steps to spoof the MAC address on the Debian or Fedora Template used for network connections.
• In Non-Qubes-Whonix, follow these steps to spoof the MAC address of the network card on a Linux, Windows or macOS host.

Time Related

• Non-Qubes-Whonix^™ only: Disable ICMP timestamps and TCP timestamps on the host operating system to prevent leakage of information.
• Non-Qubes-Whonix^™ only: Uninstall the NTP client on the host operating system and disable systemd's timdatectl NTP synchronization feature.
• Prevent possible time leaks by blocking networking until sdwdate finishes.

Tor Settings

• Consider enabling Tor connection padding for potentially better anonymity; note it is unclear whether this provides any additional benefit (see footnote).
• Consider installing newer Tor versions directly from The Tor Project repository.
• Avoid regenerating the Tor state file or manually rotating Tor guards because it degrades anonymity.
• Avoid configuring non-persistent entry guards, as this severely degrades anonymity.
• Consider using Bridges if Tor is censored, dangerous or deemed suspicious in your location.
• If using a bridge, configure alternating bridges for different physical locations.
• Heavily censored users should configure a meek-azure bridge with Anon Connection Wizard.
• To help preserve anonymity, copy Tor configuration files and settings to any new sys-whonix instance which is created.

Whonix^™ VM Security

• Consider disabling the Control Port Filter Proxy to reduce the attack surface of both the Whonix-Gateway^™ and Whonix-Workstation^™.
• Consider hardening systemcheck.
• Consider the periodic deletion and recreation of VMs that are used for sensitive operations.
  • If a compromise of Whonix-Gateway^™ and/or Whonix-Workstation^™ is suspected, follow the compromise recovery instructions.

Difficult

Anti-Evil Maid

• Consider the Android Haven application for sensitive devices -- motion, sound, vibration and light sensors can monitor and protect physical areas.
• If a Trusted Platform Module (TPM) is available, enable it in BIOS/UEFI and configure the required services to protect against Evil Maid Attacks.
  • Qubes-Whonix^™: Utilize AEM protection to attest that only desired (trusted) components are loaded and executed during the system boot.
• See Kicksecure^™ AEM Documentation

Chaining Anonymizing Tunnels

• Avoid this course of action. The anonymity benefits are unproven and it may actually hurt a user's anonymity and security goals.
• Virtual Private Network (VPN) tunnel-links are strongly recommended against due to multiple security and anonymity risks.

Disposables

Qubes / Qubes-Whonix^™ only.
Note: Some traces of Disposable usage and data contents will leak into the dom0 filesystem and survive reboots; see here for further information. (This is a Qubes-specific issue and unrelated to Whonix^™.)

• Run all instances of Tor Browser in a Disposable which is preferably uncustomized to resist fingerprinting.
• Configure each ServiceVM as a static Disposable to mitigate the threat from persistent malware accross VM reboots.
• Until fully ephemeral Disposables are available by default in a future Qubes release, advanced users can consider configuring them manually:
  • Unman's guide to ephemeral Disposables creates a RAM-based storage area.
  • anywaydense's guide to ephemeral PVH Disposables encrypts data written to the disk with an ephemeral encryption key only stored in RAM.

Email

All Platforms

• Follow the Whonix^™ recommendations to select an email provider compatible with privacy and anonymity.
• For anonymous PGP-encrypted email over Tor, use Mozilla Thunderbird.
• For greater email or message security, consider using the OneTime application or a Physical One-time Pad for military-grade encryption.
• Follow all other email principles for greater safety.

Qubes-Whonix^™ Only

• Use split-GPG for email to reduce the risk of key theft used for encryption / decryption and signing.
• Create an App Qube that is exclusively used for email and change the VM's firewall settings to only allow network connections to the email server and nothing else ("Deny network access except...").
• Only open untrusted email attachments in a Disposable to prevent possible infection.

Ethernet/FDDI Station Activity Monitor

• Consider running ArpON as a daemon to defend against ARP attacks like ARP spoofing, ARP cache poisoning and ARP poison routing.
• Consider utilizing Arpwatch to be alerted about any changes to the database of Ethernet MAC addresses seen on the network.

Flash the Router with Opensource Firmware

Warning: risk of bricking your router!

• Flash the insecure, limited-utility, proprietary firmware on the router with a powerful, open-source GNU/Linux alternative.

Mix Personal Tor Traffic with Own Tor Bridge or Relay

• See Host a Bridge or Tor Relay; this configuration might make adversary classification of Tor traffic more difficult.

Multi-Factor User Authentication

• Set up two-factor authentication (2FA) to strengthen the security of online accounts, smartphones, web services, access to physical locations and other implementations.
• Configure PAM USB as a module that only allows user authentication by inserting a token (a USB stick), in which a one-time password is stored.
• For secure account logins, utilize a Nitrokey hardware authentication device which supports one-time passwords, public-key encryption, and the Universal 2nd Factor (U2F) and FIDO2 protcols.
  • Qubes: Check the YubiKey (will be not much different from Nitrokey) instructions to enhance the security of Qubes user authentication, mitigate the risk of password snooping, and to improve USB keyboard security.

Systemd Sandboxing

• Create drop-in .conf files to sandbox systemd services.

Whitelisting Tor Traffic

• Qubes-Whonix^™: Configure sys-whonix to use corridor as a filtering gateway to ensure only connections to Tor relays pass through.
• Non-Qubes-Whonix or Qubes-Whonix: Use a standalone corridor as a filtering gateway.

Expert

Disable Intel ME Functionality

Warning: high risk of bricking your computer!

• It is possible to partially deblob Intel's despicable ME firmware image by removing unnecessary partitions from it.
• Alternatively, Intel ME's "High-Assurance Platform" mode can be set manually to disable most ME capabilities.

Disable SUID-enabled Binaries

This is an experimental feature recommended for testers.

• Consider enforcing the SUID Disabler and Permission Hardener to increase the security of the system; see here for instructions.

Opensource Firmware

• Libreboot is no longer recommended as a proprietary firmware alternative; see footnote.
• Coreboot is a possible BIOS/UEFI firmware alternative -- consider purchasing hardware that has it pre-installed (like Chromebooks), or research flashing procedures for the handful of refurbished motherboards that support it.
  • Note: The open Qubes ticket on Research support for libreboot/coreboot-based systems makes the opensource firmware recommendation generally unsuitable for Qubes-Whonix^™ at present.
  • Exception: Several laptops meet Qubes' Certified Hardware requirements and are configured with Coreboot, Heads and a partially disabled Intel Management Engine.

Physical Isolation

Non-Qubes-Whonix^™ only.

• If additional hardware is available, consider Physical Isolation in Non-Qubes-Whonix.

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

FREE  ·  PLUS  ·  PREMIUM Support

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012-2023 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 10 year success story and maybe DONATE!